Audit evidence claims and disable unsupported product paths

[arena-ai-coding-agent]

Summary

• Reconcile repository docs, AI guidance, governance, readiness, and test descriptions with the actual source-only/prototype scope; distinguish model-level declarations from compiler, runtime, ABI, conformance, and deployment evidence.
• Make authentication, MFA, token issuance, certificate signing/validation/OCSP/CRL, PQC operations, and DNSSEC operations fail closed where the ABI lacks the necessary credentials, cryptographic material, or backend. Qualify the DNS parser/response builder and binding claims.
• Disable/remove unvalidated root container, cloud, release, Pages, and benchmark scaffolding; make the remaining experimental Fly.io entry point refuse to run cloud commands.
• Replace success-shaped source-inspection placeholders with explicitly labelled heuristic/inventory checks and a bounded selected-package test workflow. Disable unsafe direct OCaml-to-Zig externals until OCaml-compatible C stubs exist.
• Add the project-specific RSR capability inventory and security contact; synchronize the root and contractile Justfiles; remove the inapplicable generic dogfood gate; pin the central estate composite actions to the exact commit already recorded in the action lock.

Local verification

• bash tests/source_smoke_test.sh — 68 pass, 0 fail, 4 explicit skips; source-pattern checks only.
• bash tests/aspect/security_test.sh — 62 pass, 0 fail, 0 skips; source heuristics only, not a security audit.
• bash tests/binding_inventory.sh — registry/inventory and source-policy checks pass; no binding compile or conformance claim.
• bash -n over all 10 shell scripts — passed.
• PyYAML parsed all 16 workflow YAML files and actions.lock; this is syntax parsing, not actionlint validation.
• git diff --check, synchronized Justfile comparison, and local metadata/onboarding checks — passed.
• Standards capability-gate checker — passed; effective capabilities are bash, idris2, and zig.

Limits / follow-up

Idris2, Zig, Just, GPG, and actionlint are unavailable in this workspace. No compiler-backed build/test, formal-proof check, binding compile/link, runtime/conformance test, or security scan was run. The action-lock generator could not be downloaded; the direct workflow map was reconciled manually, and retained transitive dependency entries may be stale.

All nine GitHub Actions workflow runs triggered by this PR ended in startup_failure before creating jobs or logs, including the newly added static and selected-package workflows; GitHub exposed no actionable failure details. This is not a passing CI result and needs investigation before merge. CodeFactor, GitGuardian, Codeac, and Semgrep passed. CodeRabbit's status check passed but it skipped substantive review because the PR author was a bot user.

Please review the scope and the explicit evidence limits before merge.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5fa0e344-b2d4-4bb8-9d89-6216e838e5a1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}